Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've installed and configured a radius server upon my localhost - it is delegating auth to a remote LDAP server.

Initially things look good: I can test via the console:

# export user=skemp
# export pass=xxx
# radtest $user $pass localhost 1812 $secret
Sending Access-Request of id 185 to port 1812
    User-Name = "skemp"
    User-Password = "xxx"
    NAS-IP-Address =
    NAS-Port = 1812
rad_recv: Access-Accept packet from host port 1812, id=185,

Similarly I can use the login tool to do the same thing:

bash-4.0# /usr/libexec/auth/login_radius -d -s login $user radius
Password: $pass

However remote logins via SSH are failing, and so are invokations of "login" started by root. Looking at /var/log/radiusd.log I see no actual log of success/failure which I do see when using either of the previous tools.

Instead sshd is just logging:

 sshd[23938]: Failed publickey for skemp from
 sshd[23938]: Failed keyboard-interactive for skemp from port 36259 ssh2
 sshd[23938]: Failed password for skemp from port 36259 ssh2

In /etc/login.conf I have this:

# Default allowed authentication styles


share|improve this question

I had similar issues with configuring OpenBSD to deligate authentications to a ldap server. The only way I could get it to work was by adding a user to the local db, e.g.

useradd -s /bin/ksh -L ldap new_user

In your case, it would be something like

useradd -s /bin/ksh -L radius new_user2

However, since you have to manually create a user entry for each machine that is using ldap for authentication, it would undermine the need for a centralized ldap authentication server. I am also out of ideas.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.